Radiant Capital’s security breach has become one of the clearest recent examples of how modern crypto attacks no longer rely on smart contract flaws alone. Instead, this incident appears to have combined social engineering, endpoint compromise, malware deployment, transaction spoofing, and multisig manipulation into a coordinated operation that ultimately resulted in the theft of roughly $50 million.
The case has drawn broad attention across the DeFi industry because Radiant was not described as an obviously careless project. On the contrary, public commentary surrounding the incident emphasized that the compromised signers were believed to have followed widely accepted operational security practices. That is precisely what makes the breach so alarming: it demonstrates that even teams using established safeguards can still be vulnerable when attackers exploit human trust, device-level access, and weaknesses in transaction visibility.
How the Attack Began
According to the incident details cited by Radiant Capital and security reporting referenced by OneKeyHQ, the compromise began on September 11. A Radiant developer received a Telegram message from someone impersonating a trusted former contractor. The message was crafted to appear routine and credible. The impersonator claimed to be looking for a new opportunity in smart contract auditing and asked for feedback on previous work.
To support the story, the attacker provided a link to what appeared to be a compressed PDF file containing details of the contractor’s next assignment. The impersonation reportedly extended beyond a simple chat message: the hackers also mimicked the contractor’s legitimate website to strengthen the illusion that the request was genuine. This is a classic hallmark of advanced social engineering in crypto operations, where attackers do not rush the target but instead build a believable context around the malicious file.
Inside the zip archive was not a harmless document, but a disguised executable known as INLETDRIFT. Once opened on the developer’s macOS device, the file installed malware that communicated with infrastructure controlled by the attackers. At that point, the adversaries had established a foothold on the machine and could begin monitoring activity, intercepting data, and preparing for the next phase of the operation.
From Device Compromise to Team-Wide Exposure
The incident became even more damaging because the infected file was reportedly shared internally with other team members for review and feedback. What looked like normal collaboration helped the malware spread deeper into the organization. This element is especially important for DeFi teams, where remote work, external communications, and quick document exchange are common. In such environments, a single compromised file can become an entry point into a broader operational network.
After obtaining enough access, the attackers moved beyond simple espionage. They allegedly executed a man-in-the-middle (MITM) attack against the signing workflow used by the team. Radiant relied on Gnosis Safe multisig wallets to secure critical assets, a security measure widely considered stronger than single-key custody. But multisig protections can be undermined if the devices used by signers are compromised and the transaction details they see are manipulated in real time.
That is what appears to have happened here. On the signers’ screens, transactions looked legitimate. Behind the scenes, however, the malware intercepted and altered the transaction data. Instead of harmless or expected actions, the attackers substituted malicious instructions aimed at taking control of the lending pool contracts.
The Role of Blind Signing in the Theft
A key part of the attack involved what the report described as a blind signing vulnerability in Ledger wallets. Blind signing refers to approving a transaction without being able to review a complete, human-readable summary of what the transaction will actually do. This can be especially dangerous in complex smart contract environments where one function call can transfer ownership, change administrative privileges, or trigger cascading asset movements.
In the Radiant case, attackers allegedly used this weakness to persuade developers to approve a transferOwnership() call. Once that authorization went through, control over the relevant contracts effectively shifted to the attackers. From there, the theft unfolded with remarkable speed.
Radiant’s report indicates that the hackers drained the funds in under three minutes. They then removed backdoors and erased traces of their activity, leaving investigators with limited forensic evidence. The speed and precision of the sequence suggest a highly prepared adversary that understood both the technical environment and the team’s operational behavior.
Why the Breach Matters for DeFi
This incident is important because it broadens the industry’s understanding of what “security” really means in decentralized finance. Too often, security discussions are limited to contract audits, formal verification, or bug bounties. Those tools remain essential, but the Radiant case shows that a protocol can still suffer catastrophic losses if attackers compromise the people and devices surrounding the protocol.
In this case, the exploit path was not presented as a straightforward bug in Radiant’s smart contracts. Instead, it was a layered attack chain that moved from impersonation to malware, from malware to transaction manipulation, and from manipulated signing to control over protocol funds. That makes the incident a warning not only for developers, but also for DAO operators, multisig signers, treasury managers, and infrastructure providers.
The report also linked the attack strongly to North Korean hackers, adding to a growing list of sophisticated crypto intrusions attributed to state-aligned or state-tolerated threat groups. Whether targeting exchanges, bridges, or DeFi treasuries, such actors have repeatedly demonstrated patience, operational discipline, and the ability to exploit weak points far outside smart contract code.
Key Lessons for Crypto Teams
Several practical lessons stand out. First, crypto organizations should reduce or eliminate the habit of downloading unverified files from external contacts, even when those contacts appear familiar. The fact that this attack began with an apparently routine request is a reminder that trust itself is now part of the attack surface.
Second, collaboration practices matter. Security-conscious teams may need to shift more of their review workflows toward safer online tools rather than exchanging compressed files and local documents. This is particularly relevant for high-privilege contributors and signers who interact with treasury infrastructure.
Third, front-end transaction verification is not enough if the endpoint is already compromised. What a signer sees on screen can be spoofed. Projects may therefore need stronger transaction validation tooling, supply chain monitoring, and independent verification channels that make it harder for malware to silently alter what is being signed.
Fourth, hardware wallets remain valuable, but they are not a complete solution when transaction summaries are incomplete or difficult to interpret. Better support for complex multisig workflows, clearer on-device display of contract actions, and richer signing context could reduce the risks associated with blind approval.
Finally, governance architecture matters. The source material notes that timelocks and stronger governance frameworks can help delay critical asset transfers. In practice, this creates time for anomaly detection, review, and emergency response before funds leave the protocol irreversibly.
What Happens Next
Radiant DAO said it continues to support Mandiant in the investigation and is also cooperating with Zeroshadow and U.S. law enforcement in efforts to freeze stolen assets. The protocol has additionally stated that it wants to share the lessons from the incident to help raise security standards across the wider industry.
That may ultimately be the most durable outcome of the breach. The Radiant Capital hack is not just another loss figure in crypto’s long history of exploits. It is a case study in how attackers can bypass conventional defenses by targeting the connections between people, devices, software interfaces, and governance systems. For DeFi, the message is clear: security can no longer be treated as a narrow smart contract problem. It must be approached as an end-to-end operational discipline.